Summary
This week's digest highlights a surge in ransomware attacks on healthcare, with the 'Vortex' group targeting various organizations. New regulatory guidance on biometric data, amendments to Saudi PDPL, and significant AI funding rounds further shape the landscape for healthcare data protection and regulatory compliance.
This edition covers a sharp uptick in ransomware activity directed at healthcare and pharmaceutical organisations, new supervisory guidance on biometric data processing from Spain's data protection authority, proposed amendments to Saudi Arabia's personal data law, updated UK guidance on special category data, and a selection of significant funding rounds in AI-driven healthtech and biotech.
1. Healthcare Ransomware: A Dangerous Week for Patient Data
'Vortex' Group Lists US Healthcare and Med-Tech Organisations
Threat-intelligence trackers including Ransomware.live and FalconFeeds identified a newly emerged extortion group operating under the name 'Vortex', which had listed approximately 11 organisations on its dark-web leak site by mid-November 2026. Among the named victims are at least three entities relevant to healthcare-sector monitoring, including Pyramid Healthcare, a US behavioural health provider. The group's rapid listing pace suggests it is actively harvesting sensitive health information, which may qualify as special category data under Article 9 of the UK and EU General Data Protection Regulations (GDPR), creating heightened notification and remediation obligations for affected controllers.
Park Dental Partners Breach Affects 1.27 Million Patients
Park Dental Partners disclosed an unauthorised network access event that began on 28 August 2026, filing an SEC Form 8-K on 1 September 2026 and completing its data review on 7 October 2026. A filing with the Texas Attorney General confirmed that 1,276,335 individuals nationally were affected, making this one of the largest dental-sector breaches on record. Organisations holding protected health information (PHI) under the US Health Insurance Portability and Accountability Act (HIPAA) must notify affected individuals within 60 days of discovering a breach; the notification letters began to be mailed on approximately 6 November 2026.
Sutherland Healthcare Solutions: Two-Year Unauthorised Access to Claims Data
Sutherland Healthcare Solutions Inc., a claims processing vendor serving health insurers, disclosed that an unauthorised individual acting through a Sutherland employee accessed claims data at various points between 29 July 2024 and 10 July 2026, an unusually long dwell time of approximately two years. The incident raises significant questions about vendor oversight under HIPAA Business Associate Agreements and, where EU or UK data subjects are involved, the contractual and audit obligations that controllers must impose on data processors under Article 28 GDPR. Controllers relying on third-party claims processors should review their data processing agreements and consider whether periodic security audits are contractually mandated.
N0n Ransomware Group Claims Breach of Dompé Farmaceutici's US Claims Data Warehouse
The extortion group N0n listed Italian pharmaceutical company Dompé Farmaceutici S.p.A. as a victim on 6 November 2026, with the leak page describing a US-facing health claims data warehouse containing patient prescription, procedure and diagnosis histories for its ophthalmology business. The listing's 'not paid, exposed' status indicates that the data may already be publicly accessible to other threat actors, heightening the risk of secondary exploitation. For a European pharmaceutical company holding US patient claims data, this incident may trigger parallel notification obligations under HIPAA, any applicable US state breach notification laws, and potentially the EU GDPR if data relating to EU-resident individuals is involved.
Perry Johnson Medical Transcription: Multistate AG Settlement of Up to $10 Million
Perry Johnson and Associates (PJ&A), a medical transcription company, reached a multistate attorney general settlement of up to $10 million following a breach that exposed data belonging to approximately 4.2 million New Yorkers alone. Investigators found that attackers used a coding employee's stolen credentials to access a remote-access system lacking multifactor authentication, then moved laterally using unencrypted passwords discovered in internal files. Critically, PJ&A's monitoring software detected the intrusion but had no alerting configured, meaning the company only became aware of the breach when the attackers made contact; this operational failure will resonate with any organisation assessing the adequacy of its technical and organisational measures under Article 32 GDPR or the HIPAA Security Rule.
Additional Incidents: Amplifon, Hoag Memorial and Doctor Anywhere
Amplifon (USA) Inc. confirmed that unauthorised access to its systems between 18 January and 8 February 2026 compromised health and government identification data, with notification to the Texas Attorney General completed on 6 October 2026. Hoag Memorial Hospital Presbyterian, a California healthcare network in Orange County, detected suspicious activity on 8 October 2026, confirmed unauthorised file access on 25 October 2026 and began patient notifications shortly thereafter. In South-East Asia, telehealth platform Doctor Anywhere, which serves over 3 million users, reported a personal data leak from unauthorised third-party access and filed notifications with Singapore's Personal Data Protection Commission (PDPC) and police; the breach also affected Adept Health, its corporate-benefits subsidiary serving more than 1,000 employer accounts, amplifying the potential impact on commercially sensitive health data.
(Read more) | https://www.classaction.org/data-breach-lawsuits/hoag-memorial-hospital-presbyterian-november-2026 | https://www.malaymail.com/news/singapore/2026/11/07/doctor-anywhere-with-over-three-million-users-in-south-east-asia-reports-personal-data-leak-in-singapore/242293
2. Supervisory Guidance: Biometrics, Special Category Data and AI Impact Assessments
AEPD Clarifies Necessity and Proportionality Tests for Biometric Verification
The Agencia Española de Protección de Datos (AEPD), Spain's national data protection supervisory authority, published a legal criteria document clarifying how controllers must apply the Article 9(2) GDPR necessity and proportionality tests when processing biometric data, specifically in the context of facial identity verification. The AEPD considers explicit consent for facial verification valid where customers are offered a practicable non-biometric alternative, and it distinguishes two risk tiers: one-to-one (1:1) verification, where a person's facial image is compared against a single reference template, is treated as materially lower risk than one-to-many (1:N) identification against a database. Critically, the authority clarifies that the existence of a less intrusive method does not automatically rule out biometrics, provided no equally effective alternative is available. Controllers deploying biometric onboarding or authentication systems should document this analysis, noting that a 1:1 process with immediate deletion and no stored template carries a substantially different risk profile from population-scale identification systems.
(Read more) | https://www.biometricupdate.com/202611/aepd-clarification-of-gdprs-necessity-clause-widens-door-for-biometrics
ICO Updates Special Category Data Guidance Following Data (Use and Access) Act 2025
The UK Information Commissioner's Office (ICO) updated its guidance on special category data to reflect the Data (Use and Access) Act 2025, a UK statute that amends and supplements the UK GDPR and the Data Protection Act 2018. The updated guidance includes interactive tools for identifying which Article 9 and Schedule 1 DPA 2018 conditions apply to a given processing activity. Key clarifications address research safeguards, the treatment of genetic and biometric data, health data collected from wearable devices, the requirement to conduct Data Protection Impact Assessments (DPIAs) for high-risk processing, and mandatory disclosures in privacy notices. Life sciences organisations processing health, genetic or biometric data under a research exemption should review the updated conditions to confirm that their existing lawful basis documentation remains aligned with the new framework.
APDCAT Releases Offline FRIA Application for AI Fundamental Rights Impact Assessments
The Autoritat de Protecció de Dades de Catalunya (APDCAT), the Catalan data protection authority, released a free offline application (compatible with Windows, macOS and Linux, in Catalan, Spanish and English) to assist organisations in conducting Fundamental Rights Impact Assessments (FRIAs) under Article 27 of the EU AI Act, the EU Regulation 2024/1689 on artificial intelligence. The accompanying guidance document includes a worked use case on a medical device used to detect cancer, making it directly relevant to healthtech and life sciences deployers. Because the application runs entirely on the user's device and makes no remote connections, it mitigates the risk that sensitive assessment data is transmitted externally during the evaluation process.
3. Global Regulatory Developments: Saudi Arabia PDPL Amendments
SDAIA Proposes Strengthened PDPL Implementing Regulations
Saudi Arabia's Saudi Data and AI Authority (SDAIA) has opened a public consultation on proposed amendments to the Implementing Regulations of the Personal Data Protection Law (PDPL), the Kingdom's primary data protection statute. The proposals would introduce requirements for local data storage in certain circumstances, expand the scope of activities requiring Data Protection Impact Assessments (DPIAs), mandate appointment of Data Protection Officers (DPOs) for certain controllers, require registration in a National Register, tighten marketing consent rules and shorten response deadlines for data subject requests. International data transfers would remain permitted subject to existing PDPL conditions. For multinational biotech and pharmaceutical companies with operations or clinical research activities in the Gulf Cooperation Council region, these amendments merit close monitoring, as they would materially increase accountability obligations if adopted in their current form.
4. Research Data and AI: Governance Failures and Investment Momentum
Weill Cornell Medicine: Radiology Research Data Used in Unapproved External AI Tools
Weill Cornell Medicine disclosed an incident in which radiology imaging data and associated health information from a research study were reportedly processed using external AI tools that had not been approved under the study's Institutional Review Board (IRB) ethics authorisation. This case is distinct from an earlier March 2026 Weill Cornell incident involving a former employee improperly accessing 516 patients' contact and visit-reason data. The present incident illustrates a governance gap that is increasingly common as researchers adopt general-purpose AI tools: processing personal data outside the scope of the original ethics approval may void the lawful basis for that processing under GDPR Article 89, which permits derogations from data subject rights only where specific safeguards are in place, and may also constitute a HIPAA violation where PHI is involved. Research institutions should ensure that AI tool procurement and use are expressly addressed within their IRB protocols and data management plans.
AI and Clinical Data Platform Funding: nPhase, Sentra and Laza Medical
nPhase closed a $30 million Series D round for its clinical data platform, while Sentra, a data security company co-founded by Asaf Kochan and CEO Yoav Regev, secured $150 million led by Capital One Ventures to expand its AI agent data access governance capabilities, pushing cumulative funding above $250 million. Laza Medical, founded within medtech incubator Shifamed, secured up to $160 million in Series B financing led by GE HealthCare to advance an AI-driven robotic imaging system for cardiac catheterisation laboratory environments. These investments reflect sustained institutional confidence in AI-powered tools for healthcare operations and clinical research; organisations procuring such platforms must ensure that any processing of personal or health data is governed by appropriate data processing agreements and, where relevant, transfer impact assessments for cross-border data flows.
(Read more) | https://runtimewire.com/article/sentra-raises-150m-capital-one-ventures-ai-data-security | https://runtimewire.com/article/laza-medical-160m-series-b-ge-healthcare-ai-cath-lab-imaging
SRTD Biotech and Roche: European Biotech and AI Protein Discovery Partnerships
SRTD Biotech, a German RNA therapeutics company founded in 2019, closed a €31.5 million seed round led by Mérieux Equity Partners via its Mérieux Innovation 2 fund, with co-investment from NRW.BANK and corporate venture arms of both Boehringer Ingelheim and Lilly Ventures. Separately, Chai Discovery, an AI molecular engineering company backed by Sequoia Capital and Kleiner Perkins among others, announced an enterprise collaboration with Roche to deploy its Chai-3 generative biology foundation model across Roche's global therapeutic discovery programmes. Both transactions highlight the growing role of data-intensive AI platforms in early-stage drug discovery, where sponsors must consider from inception how research data, including any biological sample data or derived genetic information, will be governed across multinational research collaborations.
(Read more) | https://hitconsultant.net/2026/11/05/chai-discovery-roche-partner-ai-protein-therapeutics-chai-3/
Stay Informed with iliomad
If your organisation is navigating data protection obligations in clinical research, assessing AI tool deployment under the EU AI Act, or reviewing vendor agreements following the incidents covered in this digest, the iliomad team can provide targeted, practical support. Contact us at iliomad.com to discuss how we can assist with DPIAs, data processing agreements, transfer impact assessments and regulatory compliance programmes tailored to the life sciences sector.
FAQs
Our frequently questions
As significant investment flows into AI-powered healthcare platforms — such as nPhase, Sentra and Laza Medical — organisations procuring these tools must ensure robust data governance is in place from the outset. Key steps include: ensuring appropriate Data Processing Agreements (DPAs) are in place with platform providers; conducting Transfer Impact Assessments (TIAs) where data crosses international borders; completing Data Protection Impact Assessments (DPIAs) for high-risk processing activities; and verifying that the platform's data access and security model aligns with GDPR, HIPAA and any applicable national regulations. For AI tools used in drug discovery or clinical research involving biological sample or genetic data, governance frameworks should be established at inception across all multinational research collaborations.
The Weill Cornell Medicine incident illustrates a critical governance gap: processing personal data using external AI tools not approved under a study's Institutional Review Board (IRB) ethics authorisation may void the lawful basis for that processing. Under GDPR Article 89, derogations from data subject rights for research purposes are only valid where specific safeguards are in place; using unapproved tools may fall outside the scope of those safeguards. Where PHI is involved, it may also constitute a HIPAA violation. Research institutions should ensure that AI tool procurement and use are expressly addressed within their IRB protocols and data management plans before any external tools are deployed.
Saudi Arabia's SDAIA has proposed significant amendments to the PDPL Implementing Regulations that would materially increase accountability obligations for organisations operating in the Gulf Cooperation Council region. The proposals include requirements for local data storage in certain circumstances, expanded scope for Data Protection Impact Assessments (DPIAs), mandatory appointment of Data Protection Officers (DPOs), registration in a National Register, stricter marketing consent rules and shorter response deadlines for data subject requests. International data transfers would remain permitted under existing PDPL conditions. Multinational biotech and pharmaceutical companies with operations or clinical research activities in the region should closely monitor these developments and assess the impact on their compliance programmes.
According to AEPD guidance, controllers must document a necessity and proportionality analysis before processing biometric data. Explicit consent for facial verification is valid where customers are offered a practicable non-biometric alternative. The AEPD distinguishes two risk tiers: one-to-one (1:1) verification — comparing a face against a single reference template — carries materially lower risk than one-to-many (1:N) identification against a database. The existence of a less intrusive method does not automatically rule out biometrics, provided no equally effective alternative is available. Controllers should document this analysis and note that a 1:1 process with immediate deletion and no stored template carries a substantially different risk profile from population-scale identification systems.
Incidents like the Sutherland Healthcare Solutions breach — where unauthorised access lasted approximately two years — highlight the importance of robust vendor oversight. Under HIPAA, controllers must ensure that Business Associate Agreements (BAAs) are in place and enforced. Under Article 28 GDPR, controllers are required to impose contractual obligations on data processors, including the right to conduct audits and security assessments. Controllers should review their data processing agreements to confirm that periodic security audits are contractually mandated and that processors are required to report incidents promptly.
When a ransomware group such as 'Vortex' targets a healthcare organisation, the affected data is likely to qualify as special category data under Article 9 of the UK and EU GDPR, triggering heightened notification and remediation obligations for controllers. Under HIPAA, organisations holding protected health information (PHI) must notify affected individuals within 60 days of discovering a breach. Controllers must also assess whether their technical and organisational measures under Article 32 GDPR and the HIPAA Security Rule were adequate, particularly regarding monitoring, alerting configurations, multifactor authentication and access controls.
Find out how iliomad can help your company.
Only visible in production
CRO data processor: GDPR obligations, contracts and accountability in clinical trials
Understand how a CRO acts as a data processor under GDPR in clinical trials: key obligations, DPA requirements, liability and practical compliance steps.
Investigator Site Agreement GDPR: Managing EU Privacy Requirements at NIH and US Federal Sites
Learn how to handle GDPR obligations at NIH and US federal clinical trial sites, including ICF language, Data Privacy Notices and OHSRP clearance requirements.
Weekly Health and AI Privacy Digest: Cyber Incidents, GDPR Enforcement and Regulatory Shifts (Week of 27 October 2026)
This week: hospital cyber breaches, noyb GDPR complaints against Scale AI, CNIL fines Fnac Darty, FDA approvals, WHO AI roadmap and more. Digest by iliomad.
